Horse Tools 1.3.44

• Fixed: a reCAPTCHA key in the wrong box locked people out of their own site, and nothing said so. A v2 key and a v3 key are indistinguishable by eye. Put a v2 key in the box with the dropdown on V3 and Google refuses to load the widget; the hidden token is never filled; the server rejects the empty token; and the generic-error setting turns all of that into "Login failed". The person at the keyboard sees a wrong password on a password that is right, with the word reCAPTCHA appearing nowhere.
• The login form now says when reCAPTCHA failed to load, above the fields, before anything is typed. The old code called into grecaptcha without checking it existed, so a failed load threw a script error and the form went on looking normal.
• The reCAPTCHA error is no longer replaced by the generic "Login failed". Naming reCAPTCHA reveals nothing about which accounts exist, which is the only thing that masking is for.
• New: "Test these keys against Google" on the Google tab. It checks the keys currently in the boxes, not the saved ones, and tells you which of the two is wrong — v2 key in the v3 slot, secret and site key swapped, or an empty secret meaning reCAPTCHA is protecting nothing. A transport failure is reported as "could not tell" rather than as a bad key.
• Fixed: deferring JavaScript could break WordPress's own scripts. Scripts carrying inline code are skipped, and skipped scripts run before deferred ones — so anything they depend on must not be deferred either. It wasn't, and on the login screen clipboard and dom-ready were deferred while user-profile and a11y, which need them, were not. The whole dependency chain is now walked, not just one level.
• Found by reading a site that could not be logged into, rather than from the report — the report said "wrong password", which was the one thing it was not.

---

Install: download horse-tools-1.3.44.zip below, then Plugins → Add New → Upload Plugin.